popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

sok.exe

SystemBC Antivirus Malicious Library PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 May 3, 2024, 7:39 a.m. May 3, 2024, 7:45 a.m.
Size 7.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ec7154a50488ecfd5936b6fd10e0a8e3
SHA256 05135a36e3f36578a55ec1a8d0e3628a4f8912bf3c65f865cf793b58db27f357
CRC32 1BFD6CDE
ssdeep 96:1y1jUdvqRWXKB1Jww9uKT2MjQcHnjKVOIw+6dT8CKB8tBkLOq:gtKSREKB1aFKjKVV8ToUBk
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Antivirus - Contains references to security software
  • IsPE32 - (no description)
  • SystemBC_IN - SystemBC

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
193.233.132.56 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 193.233.132.56:4341 -> 192.168.56.101:49162 2400036 ET DROP Spamhaus DROP Listed Traffic Inbound group 37 Misc Attack

Suricata TLS

No Suricata TLS

host 193.233.132.56
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\socks5 reg_value powershell.exe -windowstyle hidden -Command "& 'C:\Users\test22\AppData\Local\Temp\sok.exe'"
Time & API Arguments Status Return Repeated

RegSetValueExA

 key_handle: 0x00000078
regkey_r: socks5
reg_type: 1 (REG_SZ)
value: powershell.exe -windowstyle hidden -Command "& 'C:\Users\test22\AppData\Local\Temp\sok.exe'"
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\socks5
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Coroxy.4!c
tehtris Generic.Malware
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.ExploitDcomRpc.zm
ALYac Gen:Variant.Fragtor.535127
Cylance unsafe
VIPRE Gen:Variant.Fragtor.535127
Sangfor Trojan.Win32.Coroxy.Vnoh
BitDefender Gen:Variant.Fragtor.535127
K7GW Trojan ( 005acc841 )
Arcabit Trojan.Fragtor.D82A57
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Coroxy.L
APEX Malicious
McAfee Artemis!EC7154A50488
Avast Win32:TrojanX-gen [Trj]
Kaspersky Trojan.Win32.Garvi.cbh
Alibaba Trojan:Win32/Coroxy.ca902042
NANO-Antivirus Trojan.Win32.AVI.kljjsw
MicroWorld-eScan Gen:Variant.Fragtor.535127
Rising Trojan.Generic@AI.95 (RDML:t4NxsROVAUg8sWaXwJ7j+A)
Emsisoft Gen:Variant.Fragtor.535127 (B)
F-Secure Trojan.TR/Coroxy.inrqv
DrWeb BackDoor.Coroxy.23
TrendMicro Trojan.Win32.AMADEY.YXEEBZ
Trapmine malicious.high.ml.score
FireEye Generic.mg.ec7154a50488ecfd
Sophos Mal/Generic-S
Ikarus Win32.Outbreak
Google Detected
Avira TR/Coroxy.inrqv
MAX malware (ai score=88)
Antiy-AVL Trojan/Win32.Coroxy
Kingsoft Win32.Troj.Unknown.a
Gridinsoft Trojan.Win32.Agent.sa
Xcitium TrojWare.Win32.Injector.cej@4pux8h
Microsoft Trojan:Win32/Znyonm
ZoneAlarm Trojan.Win32.Garvi.cbh
GData Gen:Variant.Fragtor.535127
Varist W32/Heuristic-172!Eldorado
AhnLab-V3 Trojan/Win.Generic.C5364164
BitDefenderTheta Gen:NN.ZexaF.36804.aqW@aiwXm5p
DeepInstinct MALICIOUS
VBA32 BScope.TrojanProxy.Sybici
Malwarebytes Generic.Malware/Suspicious
Panda Trj/Genetic.gen
TrendMicro-HouseCall Trojan.Win32.AMADEY.YXEEBZ
Tencent Win32.Trojan.Garvi.Pzfl
dead_host 193.233.132.56:4341
dead_host 192.168.56.101:49162